5 files changed, 60 insertions, 21 deletions

diff --git a/src/gmcerts.c b/src/gmcerts.c
index 32e47b40..d8e77b12 100644
--- a/src/gmcerts.c
+++ b/src/gmcerts.c
@@ -456,13 +456,8 @@ iBool checkTrust_GmCerts(iGmCerts *d, iRangecc domain, uint16_t port, const iTls
     if (!cert) {
         return iFalse;
     }
-    if (isExpired_TlsCertificate(cert)) {
-        return iFalse;
-    }
     /* We trust CA verification implicitly. */
-    //const iBool isAuth = verify_TlsCertificate(cert) == authority_TlsCertificateVerifyStatus;
-//    const iBool isAuth = iFalse; /* CA verification done during handshake */
-    if (/*!isAuth &&*/ !verifyDomain_GmCerts(cert, domain)) {
+    if (!verifyDomain_GmCerts(cert, domain)) {
         return iFalse;
     }
     /* TODO: Could call setTrusted_GmCerts() instead of duplicating the trust-setting. */
@@ -474,11 +469,12 @@ iBool checkTrust_GmCerts(iGmCerts *d, iRangecc domain, uint16_t port, const iTls
     init_String(&key);
     makeTrustKey_(domain, port, &key);
     lock_Mutex(d->mtx);
+    iBool ok = !isExpired_TlsCertificate(cert);
     iTrustEntry *trust = value_StringHash(d->trusted, &key);
     if (trust) {
         /* We already have it, check if it matches the one we trust for this domain (if it's
            still valid. */
-        if (/*!isAuth && */elapsedSeconds_Time(&trust->validUntil) < 0) {
+        if (elapsedSeconds_Time(&trust->validUntil) < 0) {
             /* Trusted cert is still valid. */
             const iBool isTrusted = cmp_Block(fingerprint, &trust->fingerprint) == 0;
             unlock_Mutex(d->mtx);
@@ -487,17 +483,23 @@ iBool checkTrust_GmCerts(iGmCerts *d, iRangecc domain, uint16_t port, const iTls
             return isTrusted;
         }
         /* Update the trusted cert. */
-        init_Time(&trust->validUntil, &until);
-        set_Block(&trust->fingerprint, fingerprint);
+        if (ok) {
+            init_Time(&trust->validUntil, &until);
+            set_Block(&trust->fingerprint, fingerprint);
+        }
     }
     else {
-        insert_StringHash(d->trusted, &key, iClob(new_TrustEntry(fingerprint, &until)));
+        if (ok) {
+            insert_StringHash(d->trusted, &key, iClob(new_TrustEntry(fingerprint, &until)));
+        }
+    }
+    if (ok) {
+        save_GmCerts_(d);
     }
-    save_GmCerts_(d);
     unlock_Mutex(d->mtx);
     delete_Block(fingerprint);
     deinit_String(&key);
-    return iTrue;
+    return ok;
 }
 
 void setTrusted_GmCerts(iGmCerts *d, iRangecc domain, uint16_t port, const iBlock *fingerprint,
diff --git a/src/gmrequest.c b/src/gmrequest.c
index 9b640cee..44ef063f 100644
--- a/src/gmrequest.c
+++ b/src/gmrequest.c
@@ -290,8 +290,14 @@ static void requestFinished_GmRequest_(iGmRequest *d, iTlsRequest *req) {
                                                                  : finished_GmRequestState);
     if (d->state == failure_GmRequestState) {
         if (!isVerified_TlsRequest(req)) {
-            d->resp->statusCode = tlsServerCertificateNotVerified_GmStatusCode;
-            setCStr_String(&d->resp->meta, "Server certificate could not be verified");
+            if (isExpired_TlsCertificate(serverCertificate_TlsRequest(req))) {
+                d->resp->statusCode = tlsServerCertificateExpired_GmStatusCode;
+                setCStr_String(&d->resp->meta, "Server certificate has expired");
+            }
+            else {
+                d->resp->statusCode = tlsServerCertificateNotVerified_GmStatusCode;
+                setCStr_String(&d->resp->meta, "Server certificate could not be verified");
+            }
         }
         else {
             d->resp->statusCode = tlsFailure_GmStatusCode;
diff --git a/src/gmutil.c b/src/gmutil.c
index 0ae0861c..fda8489b 100644
--- a/src/gmutil.c
+++ b/src/gmutil.c
@@ -682,8 +682,12 @@ static const struct {
       { 0x1f5a7, /* networked computers */
         "${error.tls}",
         "${error.tls.msg}" } },
+    { tlsServerCertificateExpired_GmStatusCode,
+      { 0x1f4C6, /* calendar */
+        "${error.certexpired}",
+        "${error.certexpired.msg}" } },
     { tlsServerCertificateNotVerified_GmStatusCode,
-      { 0x1f645,
+      { 0x1f645, /* no good */
         "${error.certverify}",
         "${error.certverify.msg}" } },
     { temporaryFailure_GmStatusCode,
diff --git a/src/gmutil.h b/src/gmutil.h
index 1bf41775..f8491781 100644
--- a/src/gmutil.h
+++ b/src/gmutil.h
@@ -43,6 +43,7 @@ enum iGmStatusCode {
     unknownStatusCode_GmStatusCode,
     invalidLocalResource_GmStatusCode,
     tlsFailure_GmStatusCode,
+    tlsServerCertificateExpired_GmStatusCode,
     tlsServerCertificateNotVerified_GmStatusCode,
 
     none_GmStatusCode                      = 0,
diff --git a/src/ui/documentwidget.c b/src/ui/documentwidget.c
index 4a4101b1..f0ee9823 100644
--- a/src/ui/documentwidget.c
+++ b/src/ui/documentwidget.c
@@ -1135,7 +1135,18 @@ static void showErrorPage_DocumentWidget_(iDocumentWidget *d, enum iGmStatusCode
                 useBanner = iFalse; /* valid data wasn't received from host */
                 appendFormat_String(src, "\n\n>%s\n", cstr_String(meta));
                 break;
-                /* fall through */
+            case tlsServerCertificateExpired_GmStatusCode:
+                makeFooterButtons_DocumentWidget_(
+                    d,
+                    (iMenuItem[]){ { rightArrowhead_Icon " Ignore Expiry and Continue Loading",
+                                       0, 0, "server.unexpire"
+                                   },
+                                   { info_Icon " ${menu.pageinfo}",
+                                     SDLK_i,
+                                     KMOD_PRIMARY,
+                                     "document.info" } },
+                    2);
+                break;
             case tlsServerCertificateNotVerified_GmStatusCode:
                 makeFooterButtons_DocumentWidget_(
                     d,
@@ -1575,12 +1586,12 @@ static void updateTrust_DocumentWidget_(iDocumentWidget *d, const iGmResponse *r
         ~d->certFlags & trusted_GmCertFlag) {
         updateTextCStr_LabelWidget(lock, red_ColorEscape warning_Icon);
     }
-    else if (d->certFlags & trusted_GmCertFlag) {
-        updateTextCStr_LabelWidget(lock, green_ColorEscape closedLock_Icon);
+    else if (~d->certFlags & timeVerified_GmCertFlag) {
+        updateTextCStr_LabelWidget(lock, isDarkMode ? orange_ColorEscape warning_Icon
+                                                    : black_ColorEscape warning_Icon);        
     }
     else {
-        updateTextCStr_LabelWidget(lock, isDarkMode ? orange_ColorEscape warning_Icon
-            : black_ColorEscape warning_Icon);
+        updateTextCStr_LabelWidget(lock, green_ColorEscape closedLock_Icon);
     }
     setBanner_GmDocument(d->doc, bannerType_DocumentWidget_(d));
 }
@@ -2631,12 +2642,27 @@ static iBool handleCommand_DocumentWidget_(iDocumentWidget *d, const char *cmd)
         addAction_Widget(dlg, SDLK_SPACE, 0, "message.ok");
         return iTrue;
     }
+    else if (equal_Command(cmd, "server.unexpire") && document_App() == d) {
+        const iRangecc host = urlHost_String(d->mod.url);
+        const uint16_t port = urlPort_String(d->mod.url);
+        if (!isEmpty_Block(d->certFingerprint) && !isEmpty_Range(&host)) {
+            iTime expiry;
+            initCurrent_Time(&expiry);
+            iTime oneHour; /* One hour is long enough for a single visit (?). */
+            initSeconds_Time(&oneHour, 3600);
+            add_Time(&expiry, &oneHour);
+            iDate expDate;
+            init_Date(&expDate, &expiry);
+            setTrusted_GmCerts(certs_App(), host, port, d->certFingerprint, &expDate);
+            postCommand_Widget(w, "navigate.reload");
+        }
+        return iTrue;
+    }
     else if (equal_Command(cmd, "server.trustcert") && document_App() == d) {
         const iRangecc host = urlHost_String(d->mod.url);
         const uint16_t port = urlPort_String(d->mod.url);
         if (!isEmpty_Block(d->certFingerprint) && !isEmpty_Range(&host)) {
             setTrusted_GmCerts(certs_App(), host, port, d->certFingerprint, &d->certExpiry);
-            d->certFlags |= trusted_GmCertFlag;
             postCommand_Widget(w, "navigate.reload");
         }
         return iTrue;